Muzaffer Murat Kilit

Analysis of a Windows information stealer packed with AutoIt and staged through in-memory loaders. The report traces process hollowing, API unhooking, .NET JIT protections, persistence, and SMTP exfiltration.

• AutoIt
• Process Hollowing
• SMTP

Technical report on Red Menshen and its BPFDoor backdoor. It covers cBPF packet filtering, AF_PACKET sockets, process masquerading, persistence, and threat hunting.

• APT Research
• Linux
• BPFDoor

A Python tool for static ELF inspection and JSON reporting. It checks mitigations, section entropy, RWX/W+X mappings, strings, and suspicious imports.

• Python
• ELF
• Static Analysis

Eight cross-platform ATT&CK technique labs with reproducible PoCs, detection notes, and mitigations. The scenarios cover privilege escalation, persistence, credential access, defense evasion, discovery, and exfiltration.

• MITRE ATT&CK
• Detection Engineering
• PoC

A Linux crackme built around parent-process debugger detection and runtime-decrypted shellcode. The write-up traces its self-modifying control flow and XOR-obfuscated flag path.

• Anti-Debug
• SMC
• Linux

A Linux crackme that uses SIGTRAP-based exception control flow to mislead debuggers. The write-up recovers its hidden validation path through NOP patching and XOR analysis.

• Exception Control Flow
• Ghidra
• XOR

A Go collector for monitoring configured .onion targets through a Tor SOCKS5 proxy. It uses Chromedp to capture rendered pages, screenshots, metadata, and scan logs.

• Go
• Tor
• Chromedp

A Go web reconnaissance tool that captures HTML, screenshots, and discovered links from a supplied URL. Chromedp renders the target and stores each collection in a structured output directory.

• Go
• Chromedp
• Web Recon

A PowerShell lab toolkit for keystroke capture, active-window tracking, Registry persistence, and staged execution. Its modules support HTTP or Telegram-based data-flow tests.

• PowerShell
• Windows
• Lab Tooling